Algorithm 2 Rejection sampling technique

Input: Message u, a matrix A randomly sampled from ${\mathbb{Z}}_q^{m\times n}$, $\mathbf{S}$(signature key) sampled from ${\{-d,\cdots ,0,\cdots ,d\}}^{m\times k}$, $H:{\{0,1\}}^{*}{\to \{v:v\in \{-1,0,1\}}^k,\Vert v\Vert <\kappa \}$, where $d\ll q^{n/m}$, $k\in \mathbb{Z}$ and $\ll m$, $\kappa$ is constant and $2^{\kappa }·\left(\genfrac{}{}{0pt}{}{k}{\kappa }\right)\ge 2^{100}$. Then there exists a constant $M=O\left(1\right)$. Output: Vector $\mathbf{z}$ and $\mathbf{c}$ 1: Obtain $\mathbf{y}$ randomly from $D_{\sigma }^m$ 2: $\mathbf{c}=H(A\mathbf{y},u)$ 3: $\mathbf{z}=\mathbf{Sc}+\mathbf{y}$ return $(\mathbf{z},\mathbf{c})$ with probability $min(\frac{D_{\sigma }^m\left(\mathbf{z}\right)}{M{D}_{\mathbf{Sc},\sigma }\left(\mathbf{z}\right)},1)$